Giter VIP home page Giter VIP logo

terraform-ibm-cbr's Introduction

Context-based restrictions module

Graduated (Supported) semantic-release pre-commit latest release Renovate enabled

This module can be used to provision and configure Context Based Restrictions.

See in particular the fscloud module that enables creating an opiniated account-level coarse-grained set of CBR rules and zones aligned with the "secure by default" principles.

ℹī¸ Tip: Changes to context-based restriction rules are propagated worldwide and have a TTL value of 10 minutes. Rule changes might not take effect until the propagation process is complete and the TTL cache is updated.

Overview

terraform-ibm-cbr

Usage

module "ibm_cbr" "zone" {
  source           = "terraform-ibm-modules/cbr/ibm//modules/cbr-zone-module"
  version          = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
  name             = "zone_for_pg_access"
  account_id       = "defc0df06b644a9cabc6e44f55b3880s" # pragma: allowlist secret
  zone_description = "Zone created from terraform"
  addresses        = [{type  = "vpc",value = "vpc_crn"}]
}

module "ibm_cbr" "rule" {
  # replace main with version
  source           = "terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module"
  version          = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
  name             = "rule_for_pg_access"
  rule_description = "rule from terraform"
  enforcement_mode = "enabled"
  rule_contexts    = [{
                      attributes = [{
                        name  = "networkZoneId"
                        value = "93a51a1debe2674193217209601dde6f" # pragma: allowlist secret
                      }]
                     }]
  resources        = [{
                      attributes = [
                        {
                          name     = "accountId"
                          value    = "defc0df06b644a9cabc6e44f55b3880s" # pragma: allowlist secret
                          operator = "stringEquals"
                        },
                        {
                          name     = "resourceGroupId",
                          value    = "8ce996b5e6ed4592ac0e39f4105351d6" # pragma: allowlist secret
                          operator = "stringEquals"
                        },
                        {
                          name     = "serviceInstance"
                          value    = "10732830-c128-48f0-aec6-c9eaa8d10c68" # pragma: allowlist secret
                          operator = "stringEquals"
                        },
                        {
                          name     = "serviceName"
                          value    = "cloud-object-storage"
                          operator = "stringEquals"
                        }
                       ]
                     }]
  operations       = [{ api_types = [{
                        api_type_id = "crn:v1:bluemix:public:context-based-restrictions::::api-type:"
                      }]
                     }]
}

Required IAM access policies

You need the following permissions to run this module.

  • Account Management
    • Editor role access
  • VPC Infrastructure Services
    • Editor role access

Requirements

Name Version
terraform >= 1.3.0, <1.7.0
ibm >= 1.62.0, < 2.0.0

Modules

Name Source Version
cbr_rule ./modules/cbr-rule-module n/a
cbr_zone ./modules/cbr-zone-module n/a

Resources

Name Type
ibm_iam_account_settings.iam_account_settings data source

Inputs

Name Description Type Default Required
addresses (List) The list of addresses in the zone 
list(object({
    type  = optional(string)
    value = optional(string)
    ref = optional(object({
      account_id       = string
      location         = optional(string)
      service_instance = optional(string)
      service_name     = optional(string)
      service_type     = optional(string)
    }))
  }))
 [] no
enforcement_mode (String) The rule enforcement mode string "report" no
excluded_addresses (Optional, List) The list of excluded addresses in the zone 
list(object({
    type  = optional(string)
    value = optional(string)
  }))
 [] no
name (Optional, String) The name of the zone string null no
operations (Optional, List) The operations this rule applies to 
list(object({
    api_types = list(object({
      api_type_id = string
    }))
  }))
 
[
  {
    "api_types": [
      {
        "api_type_id": "crn:v1:bluemix:public:context-based-restrictions::::api-type:"
      }
    ]
  }
]
 no
resources (Optional, List) The resources this rule apply to 
list(object({
    attributes = list(object({
      name     = string
      value    = string
      operator = optional(string)
    }))
    tags = optional(list(object({ #These access tags should match to the target service access tags for the CBR rules to work
      name     = string
      value    = string
      operator = optional(string)
    })))
  }))
 [] no
rule_contexts (List) The contexts the rule applies to 
list(object({
    attributes = list(object({
      name  = string
      value = string
    }))
  }))
 
[
  {
    "attributes": [
      {
        "name": "va",
        "value": "va"
      }
    ]
  }
]
 no
rule_description (Optional, String) The description of the rule string null no
zone_description (Optional, String) The description of the zone string null no

Outputs

Name Description
rule_crn CBR rule resource instance crn
rule_href CBR rule resource href
rule_id CBR rule resource instance id
zone_crn cbr_zone resource instance crn
zone_href cbr_zone resource instance link
zone_id cbr_zone resource instance id

Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See Report an issue or request a feature.

To set up your local development environment, see Local development setup in the project documentation.

terraform-ibm-cbr's People

Contributors

aashiq-j avatar aayush-abhyarthi avatar ak-sky avatar akocbek avatar daniel-butler-irl avatar iamar7 avatar jojustin avatar jor2 avatar khuzaima05 avatar kierramarie avatar marifse avatar mounika-nalla avatar ocofaigh avatar rajatagarwal-ibm avatar shemau avatar sirspidey avatar terraform-ibm-modules-ops avatar vburckhardt avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤ī¸ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.